# Update the rsa dependency \>4.3 to address CVE-2020-13757?

**URL:** <https://forum.ansible.com/t/update-the-rsa-dependency-4-3-to-address-cve-2020-13757/34057>\
**Category:** AWX Project\
**Tags:** awx-project\
**Created:** [October 19, 2020, 4:55pm UTC](https://forum.ansible.com/t/update-the-rsa-dependency-4-3-to-address-cve-2020-13757/34057 "2020-10-19T16:55:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Flores](https://avatars.discourse-cdn.com/v4/letter/d/b77776/32.png) [@David\_Flores](https://forum.ansible.com/u/David_Flores)\
**Post date:** [October 19, 2020, 4:55pm UTC](https://forum.ansible.com/t/update-the-rsa-dependency-4-3-to-address-cve-2020-13757/34057/1 "2020-10-19T16:55:11Z")

</div>

Hello everyone!

Quick question, any reason why the rsa dependency is pinned to 4.0 (requirements/requirements.txt rsa==4.0)?

I was running a scan and it triggered [CVE-2020-13757](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13757).

An upgrade to 4,3 should be good to clear it ight?

Thanks!  
David

---

<div class="post-metadata">

**Author:** ![Bill\_Nottingham1](https://avatars.discourse-cdn.com/v4/letter/b/58f4c7/32.png) [@Bill\_Nottingham1](https://forum.ansible.com/u/Bill_Nottingham1)\
**Post date:** [October 19, 2020, 5:08pm UTC](https://forum.ansible.com/t/update-the-rsa-dependency-4-3-to-address-cve-2020-13757/34057/2 "2020-10-19T17:08:29Z")

</div>

David Flores (davidflores77@gmail.com) said:

> Hello everyone!
> 
> Quick question, any reason why the rsa dependency is pinned to 4.0  
> (requirements/requirements.txt rsa==4.0)?
> 
> I was running a scan and it triggered CVE-2020-13757  
> \<[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13757&gt;\](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13757&gt;%5C).
> 
> An upgrade to 4,3 should be good to clear it ight?

It's not actually included anyway, so it doesn't matter.

See requirements\_\*\_uninstall.txt. Thanks to google for making us have to do  
this.

Bill

---

<div class="post-metadata">

**Author:** ![David\_Flores](https://avatars.discourse-cdn.com/v4/letter/d/b77776/32.png) [@David\_Flores](https://forum.ansible.com/u/David_Flores)\
**Post date:** [October 19, 2020, 5:11pm UTC](https://forum.ansible.com/t/update-the-rsa-dependency-4-3-to-address-cve-2020-13757/34057/3 "2020-10-19T17:11:53Z")

</div>

Got it!, thanks Bill. I was looking for a reference for the package until you pointed the uninstall 😊

Good to know, thanks!